Safari Warning message

[BarryinKC]

I fear I've infected my computer when prompted to update Flash. Safari is locked with the following message:


ATTENTION!
PLEASE READ BEFORE CONTINUING TO
It appears that your OS X computer and Safari web browser has popup ads ENABLED and may be at a SECURITY risk.
Please call TOLL FREE to repair this immediately at 1-866-957-4919.
PLEASE FOLLOW THESE INSTRUCTIONS:
Before you use , it is strongly advised that you call to disable popup ads. You can do so by calling 1-866-957-4919 now.

1244.locationtoeat.info

Am I in trouble. What should I do?

Barry

 

[honestone]

Need to know the following:

1. What exact Mac model do you have?

2. What exact OS are you using?

3. What version of Safari do you have?

Even with all that, your first step is to download the excellent free adware "killer" program Malwarebytes Anti-Malware. You can get it from here:

https://www.malwarebytes.org/mwb-download/

Also, DO NOT call that number. It is most likely a scam.

Additionally, try another browser, like Firefox or Google Chrome. See if you get the same message with either of those.

 

[BarryinKC]

Need to know the following:

1. What exact Mac model do you have?

2. What exact OS are you using?

3. What version of Safari do you have?

Even with all that, your first step is to download the excellent free adware "killer" program Malwarebytes Anti-Malware. You can get it from here:

https://www.malwarebytes.org/mwb-download/

Also, DO NOT call that number. It is most likely a scam.

Additionally, try another browser, like Firefox or Google Chrome. See if you get the same message with either of those.

Thanks for your quick reply. I must have really screwed up. Everything of the affect computer is locked. I'm using my iMac for this message.

The infected computer is my Mac Air. I am using OS X 10.8.5. I cannot access the screen to display the Safari version.

Likewise I cannot link to the malwarebytes site you recommended.

Am I at the point I need the Genius Bar?

Barry

 

[honestone]

What exact iMac model do you have? And, what exact MacBook Air model do you have?

Once you let is know that, there is a possibility that your MacBook Air can be started up in Target Disk Mode, and tools on your iMac can be used to try and solve the issues with your MacBook Air. But, need the exact Mac models first.

 

[ad2think]

I have a mac desktop that also has this message. it is a 2.7ghz intel core i5 running os 10.9.5. I downloaded the malwarebytes software and it did not remove it. any advice on what to try?

 

[BarryinKC]

What exact iMac model do you have? And, what exact MacBook Air model do you have?

Once you let is know that, there is a possibility that your MacBook Air can be started up in Target Disk Mode, and tools on your iMac can be used to try and solve the issues with your MacBook Air. But, need the exact Mac models first.

I hope this is what you need. I rely on my computers for work but have frighteningly little knowledge of terminology and how they work.

For the MacBook Air
13-inch Mid 2012
Processor 1.8 GHz Intel Core i5
Memory 4 GB 1600 MHz DDR3
Graphics Intel HD Graphics 4000 512 MB
Software Mac OS X 10.8.5 (12F45)

For the iMac…
21.5-inch, Late 2009
Processor 3.06 GHz Intel Core 2 Duo
Memory 4 GB 1067 MHz DDR3
Graphics NVIDIA GeForce 9400 256 MB
Software Mac OS X Lion 10.7.5 (11G63)

Thanks for your time working with me.

 

[honestone]

I hope this is what you need. I rely on my computers for work but have frighteningly little knowledge of terminology and how they work.

For the MacBook Air
13-inch Mid 2012
Processor 1.8 GHz Intel Core i5
Memory 4 GB 1600 MHz DDR3
Graphics Intel HD Graphics 4000 512 MB
Software Mac OS X 10.8.5 (12F45)

For the iMac…
21.5-inch, Late 2009
Processor 3.06 GHz Intel Core 2 Duo
Memory 4 GB 1067 MHz DDR3
Graphics NVIDIA GeForce 9400 256 MB
Software Mac OS X Lion 10.7.5 (11G63)

Thanks for your time working with me.

Thanks for the information. It is very helpful.

From what you said above, "Everything of the affect computer is locked.", that seems to indicate that the MacBook Air will not even boot up! I hope that is not the case. Please clarify that for me, as it affects what I am proposing.

Also, I forgot to ask you another important question. Have you been making any kind of backups of the Air to an external device? That is just about necessary (unless you can stand to lose everything on the Air's drive).

First thing to try is to boot to the (invisible) Recovery Partition on the MacBook Air. This link describes how to boot to that partition, and what it contains:

https://support.apple.com/en-us/HT201314

Assuming that is successful, you can run Disk Utility from there to check out the drive (I believe you have a 128 gig SSD in it). Use Disk Utility to 1) Verify and Repair the disk at the Volume, ie, top level, 2) Verify and Repair the disk at the Partition, ie, second level, and 3) Verify and Repair Permissions. Not sure how successful that will be.

Now, your MacBook Air has a Thunderbolt port, and your iMac has a Firewire 800 port. Thus, the next thing to try is to boot the Air in Target Disk Mode. What you will need first is 1) a Firewire 800 cable, and 2) a Thunderbolt-to-Firewire 800 adapter. I have a mid 2013 13" MacBook Air with a Thunderbolt port, along with one of those adapters (costs $49 US Dollars), and I have successfully used it many, many times to connect either of my external hard drives, each of which has a Firewire 800 port, to my MacBook Air. With both machines off, plug the Firewire 800 cable into the iMac's Firewire 800 port, plug in the adapter to the other end of the Firewire 800 cable, and plug the other end of the Thunderbolt-to-Firewire 800 cable into the Thunderbolt port on the Air.

Next, boot up the iMac. When it is done completely booting up, start up the MacBook Air, but hold down the T key on the keyboard. (This link, http://osxdaily.com/2010/04/07/how-to-boot-a-mac-in-target-disk-mode/, discusses it in somewhat more detail). Hopefully, the Air's drive will appear on the iMac's desktop. From there, you can use whatever tools you have on the iMac to try and repair the Air's drive.

If none of that is successful, then about the only remedy is to use Disk Utility (could do it with the iMac) to 1) Erase, Format, and Partition the Air's drive, 2) do a clean installation of OS 10.8.5 (do you have the file "Install OS X Mountain Lion" somewhere on the iMac? If you do, you can install it on the Air (it will be OS 10.8), and then download and apply the OS 10.8.5 Combo Updater, which you can get from here: https://support.apple.com/kb/DL1676?locale=en_US). Finally, you can use Migration Assistant to "migrate"/copy non-Appel stuff from wherever you have it to the Air. Again, not knowing whether you have a backup or not is why I said "wherever".

 

[BarryinKC]

Thanks so much for your attention to me. I was able to get into the Apple Store and they were able to resolve my issue. I am up and running again.

Best wishes for a great Thanksgiving celebration this week.

Barry

 

[honestone]

What did they do? Such information could be helpful!

 

[BarryinKC]

They used Malwarebytes and I think Adware. They went threw Applications and deleted anything they didn't know about and that I could not identify. In that process I saw, and dumped, several items that were added yesterday after I clicked on the bad link.
I know this is a very general response to your question but as I told you I love my Macs but I'm computer illiterate. I think that's why I started with Mac back in 1985... I could just plug it in and it worked.
Thanks again for your help.
Barry

 

[honestone]

Understand. There are others, though, like myself that want to know such details, so that we can try the repairs ourselves.

As I'm sure you learned, Macs are not infallible. Yes, they are more reliable that Windows-Based machines, and the associated Windows OS, but Macs can still have issues. I guess it depends how much one wants to learn about their machines, software, the OS, etc.

Interesting that they were able to use Malwarebytes, whereas you could not get it. I wonder if they booted your machine in Target Disk Mode, and ran Malwarebytes on the "host" machine.

Also, Adware is not a program. That is the general description of stuff/crap put on your machine in a somewhat nefarious manner. Malwarebytes was used to get rid of that Adware.

 

[Skeebum]

Like the OP I ended up with this nasty little bugger on my iMac:

Processor 3.4 GHz Intel Core i5
Memory 8GB 1600 MHz DDR3
Software 0s X 10.9.5 (13F1134)

I think I picked up this "bug" last week when I thought I was responding to a prompt to update my adobe flash player. I completed the "update" and safari starting acting strangely. I started getting several pop up screens while trying to complete usual internet activities. For example, if I was on the Amazon site looking for something, I would get pop ups related to whatever I happened to be looking at. I realized I needed to address the issue. The first I did was to download firefox, so as to have a functional browser in case Safari continued to give me issues. Good thing I did, after a few days (keeping mind, I don't spend a whole lot of time on the home computer), Safari would lock up with that darn error message outlined in the OP. It also made it so most of my apps would fail to open, iPhoto, Word, Excel, etc....

Malewarebytes did the trick. I downloaded via firefox, ran it, and a variety of programs were found and deleted. After a system restart, the problem is apparently solved.

I really need to toss those boys (or girls) some cash. I owe 'em!!

For the folks who know a lot more about this stuff then me, and may have an interest, below is the file log of what malwarebytes wiped from my Mac. Perhaps it will be use to someone, I think I would have better luck trying to understand Aramaic

Cheers, Dan

System Log Follows:

2015-11-24 21:10:57 :
2015-11-24 21:10:57 : ----- Scan Started -----
2015-11-24 21:10:57 : Scanning with signatures version 35 (2015-11-24)
2015-11-24 21:10:57 : Adware.InstallCore : /Users/Dad/Library/Application Support/Firefox/Profiles/xynswcp6.default/extensions/{1f7b417d-8a05-471d-abff-b284b629f9d7}
2015-11-24 21:10:57 : Adware.Crossrider : /Users/Dad/Library/LaunchAgents/com.WebShoppers.agent.plist
2015-11-24 21:10:57 : Adware.Crossrider : /Library/LaunchAgents/com.WebShoppers.agent.plist
2015-11-24 21:10:57 : Adware.Crossrider : /Applications/WebShoppers/
2015-11-24 21:10:57 : PUP.Advanced Mac Cleaner : /Library/Application Support/amc/
2015-11-24 21:10:57 : PUP.Advanced Mac Cleaner : /Users/Dad/Library/Advanced Mac Cleaner
2015-11-24 21:10:57 : PUP.Advanced Mac Cleaner : /Users/Dad/Library/hlpramc
2015-11-24 21:10:57 : PUP.Advanced Mac Cleaner : /Users/Dad/Library/Application Support/Advanced Mac Cleaner
2015-11-24 21:10:57 : PUP.Advanced Mac Cleaner : /Users/Dad/Library/LaunchAgents/com.pcv.hlpramc.plist
2015-11-24 21:10:57 : *** scan time: 0d 00:00:00 ***
2015-11-24 21:10:57 : ------ Scan Ended ------
2015-11-24 21:11:38 : ---- File Removal Started ----
2015-11-24 21:11:38 : ===========================================
2015-11-24 21:11:38 : REMOVING ITEM: Adware.InstallCore
2015-11-24 21:11:38 : >> Removing extension item: /Users/Dad/Library/Application Support/Firefox/Profiles/xynswcp6.default/extensions/{1f7b417d-8a05-471d-abff-b284b629f9d7}
2015-11-24 21:11:38 : ===========================================
2015-11-24 21:11:38 : REMOVING ITEM: Adware.Crossrider
2015-11-24 21:11:38 : >> Removing file item: /Users/Dad/Library/LaunchAgents/com.WebShoppers.agent.plist
2015-11-24 21:11:38 : ===========================================
2015-11-24 21:11:38 : REMOVING ITEM: Adware.Crossrider
2015-11-24 21:11:38 : >> Removing file item: /Library/LaunchAgents/com.WebShoppers.agent.plist
2015-11-24 21:11:38 : ===========================================
2015-11-24 21:11:38 : REMOVING ITEM: Adware.Crossrider
2015-11-24 21:11:38 : >> Removing file item: /Applications/WebShoppers/
2015-11-24 21:11:38 : ===========================================
2015-11-24 21:11:38 : REMOVING ITEM: PUP.Advanced Mac Cleaner
2015-11-24 21:11:38 : >> Removing file item: /Library/Application Support/amc/
2015-11-24 21:11:38 : ===========================================
2015-11-24 21:11:38 : REMOVING ITEM: PUP.Advanced Mac Cleaner
2015-11-24 21:11:38 : >> Removing file item: /Users/Dad/Library/Advanced Mac Cleaner
2015-11-24 21:11:38 : ===========================================
2015-11-24 21:11:38 : REMOVING ITEM: PUP.Advanced Mac Cleaner
2015-11-24 21:11:38 : >> Removing file item: /Users/Dad/Library/hlpramc
2015-11-24 21:11:38 : ===========================================
2015-11-24 21:11:38 : REMOVING ITEM: PUP.Advanced Mac Cleaner
2015-11-24 21:11:38 : >> Removing file item: /Users/Dad/Library/Application Support/Advanced Mac Cleaner
2015-11-24 21:11:38 : ===========================================
2015-11-24 21:11:38 : REMOVING ITEM: PUP.Advanced Mac Cleaner
2015-11-24 21:11:38 : >> Removing file item: /Users/Dad/Library/LaunchAgents/com.pcv.hlpramc.plist
2015-11-24 21:11:38 : ---- File Removal Complete ----
2015-11-24 21:11:49 : ===== Attempting restart =====

 

[honestone]

Glad you worked things out, Dan. Also, your horror story just re-enforces something I posted the other day about getting updates from the (former reliable) site www.macupdate.com. I have started to only download updates either via the app directly, or doing a google search to get to the app developer's site. I did exactly that this morning. On macupdate, it showed a newer version for the nifty little program EtreCheck. Well, I quite Chrome, launched EtreCheck, and it told me there was an update available. Clicked on that, the program quit, google chrome launched, and I got directly to the developer's site for EtreCheck. Saw the update there (prominently displayed), and downloaded it from there. All is good.

 

[lms]

I fear I've infected my computer when prompted to update Flash. Safari is locked with the following message:


ATTENTION!
PLEASE READ BEFORE CONTINUING TO
It appears that your OS X computer and Safari web browser has popup ads ENABLED and may be at a SECURITY risk.
Please call TOLL FREE to repair this immediately at 1-866-957-4919.
PLEASE FOLLOW THESE INSTRUCTIONS:
Before you use , it is strongly advised that you call to disable popup ads. You can do so by calling 1-866-957-4919 now.

1244.locationtoeat.info

Am I in trouble. What should I do?

Barry

Hey Barry

Any Potential Malware issue's apple will give free support!! Just call AppleCare and Don't call that 1866# as it is bogus and they are trying to scam you!!!!!

The message is a hidden link in a website that you were on and it hangs ANY web Browser - it is ok to Quit or Force Quit the web browser and than Hold the Shift key down when reopening it from your Dock. And yes get https://www.malwarebytes.org/antimalware/mac/ to check your system for Malware!! Don't use Mackeeper unless you plan to Pay a fee for it or any other one for that matter..